The maintainer selected GPL-3.0-or-later on October 13, 2026. LICENSE contains the unmodified GNU GPL version 3 text; COPYRIGHT expressly grants the option to use any later version and defines the covered original source and technical documentation. package.json uses the SPDX identifier GPL-3.0-or-later. The source repository is public; the maintainer confirmed that it should remain public on October 13, 2026. Private acceptance artifacts and unpublished binary candidates remain separate.
New Windows packages include resources/licenses/Loadstone-GPL-3.0.txt and Loadstone-COPYRIGHT.txt; the About screen displays both texts offline. Third-party notices remain separate. The recorded 0.3.0 preview predates this decision and is not silently replaced or relabeled.
The 0.4.0 private preview procedure pairs a clean packaged revision with an exact source ZIP and local integrity/review evidence. Preparing that archive does not close public corresponding-source delivery or the publication gates below.
| Component | Current treatment |
|---|---|
| Loadstone app, adapter and tests | Project-authored source under GPL-3.0-or-later; see LICENSE and COPYRIGHT. |
| Shipped JavaScript dependencies | Versioned inventory and original license texts in notices/; regenerate with pnpm notices. |
| Electron runtime | MIT license included in generated notices; packaged Electron and Chromium license files must remain with distribution. |
| Wabbajack 4.2.3.0 | Downloaded unmodified from upstream at user request, separate process; not committed or bundled in Loadstone's portable package. Upstream GPL license and its included component notices apply. Review distribution/source obligations before changing this model. |
| MO2 and mods | Supplied by creator lists and original sources, not bundled by Loadstone. Review each list's distribution rights separately. |
| Lucide icons | Original package license copied into generated notices. |
| Fonts | src/fonts.css uses locally installed Segoe UI. No font binaries are shipped. |
| Compass logo and desktop icon | Project-created geometry; recorded in artwork provenance. Branding use policy remains to be decided. |
| Discovery backgrounds | AI-generated illustrative artwork with the prompt recorded in artwork provenance. Review for release suitability and avoid claims of exclusive rights or captured gameplay. |
| Game names and fictional demo setups | Game trademarks identify compatibility; no endorsement is claimed. Demo setups are not available modlists. Review store and README wording before publication. |
The dependency inventory is evidence for review, not a legal compatibility determination. No upstream Wabbajack/MO2 source is copied into the current app. Future linking, source reuse, bundling or modifications require another review. Build/test tooling is not fully covered by the production inventory; audit anything added to source archives or shipped build tools.
The renderer build records the packages whose modules contribute code, including generated Vite runtime code. pnpm notices combines those records with main-process dependencies. Svelte and Lucide are build dependencies with bundled runtime attribution, rather than shipping their full compiler trees. is-reference@3.0.3 and locate-character@3.0.0 remain development dependencies with missing standalone license texts; neither contributes to the current renderer bundle or belongs to the packaged production dependency graph. No upstream notice has been invented. Verify this exclusion against each release artifact; source archives containing dependency trees need a separate review. The current generated shipped inventory reports no missing license texts, which does not close distribution review or publication gates.
- Confirm the release version and final artwork/branding terms. The source-code license choice, full license text, package metadata and contribution terms are now recorded.
- Supply recipients with the exact corresponding source for every distributed executable through a GPL-compliant distribution method, including modifications and necessary build scripts and material. Public binary downloads must not direct recipients only to inaccessible private source. Retain the build commit and lockfile provenance. See GNU GPL section 6.
- Review all dependency license texts and notices against the actual package, including Electron/Chromium and external-tool distribution behavior. Do not assume a package's SPDX label is its complete notice.
- Enable a monitored private security-reporting channel; finalize support and version-support policy.
- Review tracked files, screenshots, fixtures and the complete Git history for secrets, signed URLs, personal paths and private material. Rotate any exposed credentials before considering history cleanup.
- Verify the public README against the release artifact, link its exact source tag, and separate developer preview limitations from supported features.
- Complete Windows install-to-play, Steam shortcut, recovery, save-preservation and removal acceptance; prepare the distinct Steam depot and store materials.
- Keep the source repository public. Public binary releases, Steam uploads and distribution of third-party payloads require their own completed acceptance and publication authorization.
These binary-release gates remain open. Public source availability is already authorized; it does not establish that a binary candidate or featured modlist is ready to publish.
Run pnpm audit:publication before proposing public release. See publication hygiene findings for the scan scope, classified fixtures, historical personal-path findings and outstanding manual review. The command never rewrites history and does not approve publication.